GitHub - oxsecurity/megalinter: 🦙 MegaLinter analyzes 50 languages, 22 formats, 21 tooling formats, excessive copy-pastes, spelling mistakes and security issues in your repository sources with a GitHub Action, other CI tools or locally. (original) (raw)

MegaLinter

MegaLinter, by OX Security

GitHub release Docker Pulls Downloads/week GitHub stars MegaLinter codecov

Generated by github-dependents-info Secured with Trivy GitHub contributors GitHub Sponsors PRs Welcome Tweet

MegaLinter is an Open-Source tool for CI/CD workflows that analyzes the consistency of your code, IAC, configuration, and scripts in your repository sources, to ensure all your projects sources are clean and formatted whatever IDE/toolbox is used by their developers, powered by OX Security.

Supporting 65 languages, 23 formats, 20 tooling formats and ready to use out of the box, as a GitHub action or any CI system, highly configurable and free for all uses.

MegaLinter has native integrations with many of the major CI/CD tools of the market.

GitHub Gitlab Azure Bitbucket Jenkins Drone Concourse Docker SARIF Grafana

MegaLinter Presentation GIF

Upgrade to MegaLinter v8 :)

Upgrade to v8 Video

Before going below, see Online Documentation Web Site which has a much easier user navigation than this README

Table of Contents

Why MegaLinter

Projects need to contain clean code, in order to avoid technical debt, that makes evolutive maintenance harder and time consuming.

By using code formatters and code linters, you ensure that your code base is easier to read and respects best practices, from the kick-off to each step of the project lifecycle

Not all developers have the good habit to use linters in their IDEs, making code reviews harder and longer to process

By using MegaLinter, you'll enjoy the following benefits for you and your team:

Quick Start

Runner Install

Notes:

Supported Linters

All linters are integrated in the MegaLinter docker image, which is frequently upgraded with their latest versions

Languages

Language Linter Additional
BASH bash-execBASH_EXEC
BASH shellcheckBASH_SHELLCHECK GitHub stars sarif
BASH shfmtBASH_SHFMT GitHub stars formatter
C cppcheckC_CPPCHECK
C cpplintC_CPPLINT GitHub stars
C clang-formatC_CLANG_FORMAT GitHub stars autofix
CLOJURE clj-kondoCLOJURE_CLJ_KONDO GitHub stars
CLOJURE cljstyleCLOJURE_CLJSTYLE GitHub stars autofix
COFFEE coffeelintCOFFEE_COFFEELINT GitHub stars
C++ (CPP) cppcheckCPP_CPPCHECK
C++ (CPP) cpplintCPP_CPPLINT GitHub stars
C++ (CPP) clang-formatCPP_CLANG_FORMAT GitHub stars autofix
C# (CSHARP) dotnet-formatCSHARP_DOTNET_FORMAT GitHub stars formatter
C# (CSHARP) csharpierCSHARP_CSHARPIER GitHub stars formatter
C# (CSHARP) roslynatorCSHARP_ROSLYNATOR GitHub stars formatter
DART dartanalyzerDART_DARTANALYZER GitHub stars
GO golangci-lintGO_GOLANGCI_LINT GitHub stars autofix sarif
GO reviveGO_REVIVE GitHub stars sarif
GROOVY npm-groovy-lintGROOVY_NPM_GROOVY_LINT GitHub stars autofix sarif
JAVA checkstyleJAVA_CHECKSTYLE GitHub stars sarif
JAVA pmdJAVA_PMD GitHub stars sarif
JAVASCRIPT eslintJAVASCRIPT_ES GitHub stars autofix sarif
JAVASCRIPT standardJAVASCRIPT_STANDARD GitHub stars autofix
JAVASCRIPT prettierJAVASCRIPT_PRETTIER GitHub stars formatter
JSX eslintJSX_ESLINT GitHub stars autofix sarif
KOTLIN ktlintKOTLIN_KTLINT GitHub stars autofix sarif
KOTLIN detektKOTLIN_DETEKT GitHub stars sarif
LUA luacheckLUA_LUACHECK GitHub stars
LUA seleneLUA_SELENE GitHub stars
LUA styluaLUA_STYLUA GitHub stars
MAKEFILE checkmakeMAKEFILE_CHECKMAKE disabled GitHub stars
PERL perlcriticPERL_PERLCRITIC GitHub stars
PHP phpcsPHP_PHPCS GitHub stars sarif
PHP phpstanPHP_PHPSTAN GitHub stars sarif
PHP psalmPHP_PSALM GitHub stars sarif
PHP phplintPHP_PHPLINT GitHub stars sarif
PHP php-cs-fixerPHP_PHPCSFIXER GitHub stars
POWERSHELL powershellPOWERSHELL_POWERSHELL GitHub stars autofix
POWERSHELL powershell_formatterPOWERSHELL_POWERSHELL_FORMATTER GitHub stars formatter
PYTHON pylintPYTHON_PYLINT GitHub stars
PYTHON blackPYTHON_BLACK GitHub stars formatter
PYTHON flake8PYTHON_FLAKE8 GitHub stars
PYTHON isortPYTHON_ISORT GitHub stars formatter
PYTHON banditPYTHON_BANDIT GitHub stars sarif
PYTHON mypyPYTHON_MYPY GitHub stars
PYTHON pyrightPYTHON_PYRIGHT GitHub stars
PYTHON ruffPYTHON_RUFF GitHub stars autofix sarif
PYTHON ruff-formatPYTHON_RUFF_FORMAT GitHub stars formatter
R lintrR_LINTR GitHub stars
RAKU rakuRAKU_RAKU GitHub stars
RUBY rubocopRUBY_RUBOCOP GitHub stars autofix
RUST clippyRUST_CLIPPY GitHub stars
SALESFORCE sfdx-scanner-apexSALESFORCE_SFDX_SCANNER_APEX GitHub stars
SALESFORCE sfdx-scanner-auraSALESFORCE_SFDX_SCANNER_AURA GitHub stars
SALESFORCE sfdx-scanner-lwcSALESFORCE_SFDX_SCANNER_LWC GitHub stars
SALESFORCE lightning-flow-scannerSALESFORCE_LIGHTNING_FLOW_SCANNER GitHub stars
SCALA scalafixSCALA_SCALAFIX GitHub stars
SQL sqlfluffSQL_SQLFLUFF GitHub stars
SQL tsqllintSQL_TSQLLINT GitHub stars
SWIFT swiftlintSWIFT_SWIFTLINT GitHub stars autofix
TSX eslintTSX_ESLINT GitHub stars autofix sarif
TYPESCRIPT eslintTYPESCRIPT_ES GitHub stars autofix sarif
TYPESCRIPT ts-standardTYPESCRIPT_STANDARD GitHub stars autofix
TYPESCRIPT prettierTYPESCRIPT_PRETTIER GitHub stars formatter
Visual Basic .NET (VBDOTNET) dotnet-formatVBDOTNET_DOTNET_FORMAT GitHub stars formatter

Formats

Format Linter Additional
CSS stylelintCSS_STYLELINT GitHub stars autofix
ENV dotenv-linterENV_DOTENV_LINTER GitHub stars autofix
GRAPHQL graphql-schema-linterGRAPHQL_GRAPHQL_SCHEMA_LINTER GitHub stars
HTML djlintHTML_DJLINT GitHub stars
HTML htmlhintHTML_HTMLHINT GitHub stars
JSON jsonlintJSON_JSONLINT GitHub stars
JSON eslint-plugin-jsoncJSON_ESLINT_PLUGIN_JSONC disabled GitHub stars autofix sarif
JSON v8rJSON_V8R GitHub stars
JSON prettierJSON_PRETTIER GitHub stars formatter
JSON npm-package-json-lintJSON_NPM_PACKAGE_JSON_LINT GitHub stars
LATEX chktexLATEX_CHKTEX
MARKDOWN markdownlintMARKDOWN_MARKDOWNLINT GitHub stars formatter
MARKDOWN remark-lintMARKDOWN_REMARK_LINT disabled GitHub stars formatter
MARKDOWN markdown-link-checkMARKDOWN_MARKDOWN_LINK_CHECK downgraded version GitHub stars
MARKDOWN markdown-table-formatterMARKDOWN_MARKDOWN_TABLE_FORMATTER GitHub stars formatter
PROTOBUF protolintPROTOBUF_PROTOLINT GitHub stars autofix
RST rst-lintRST_RST_LINT GitHub stars
RST rstcheckRST_RSTCHECK GitHub stars
RST rstfmtRST_RSTFMT formatter
XML xmllintXML_XMLLINT autofix
YAML prettierYAML_PRETTIER GitHub stars formatter
YAML yamllintYAML_YAMLLINT GitHub stars
YAML v8rYAML_V8R GitHub stars

Tooling formats

Tooling format Linter Additional
ACTION actionlintACTION_ACTIONLINT GitHub stars
ANSIBLE ansible-lintANSIBLE_ANSIBLE_LINT GitHub stars sarif
API spectralAPI_SPECTRAL GitHub stars
ARM arm-ttkARM_ARM_TTK GitHub stars
BICEP bicep_linterBICEP_BICEP_LINTER GitHub stars
CLOUDFORMATION cfn-lintCLOUDFORMATION_CFN_LINT GitHub stars sarif
DOCKERFILE hadolintDOCKERFILE_HADOLINT GitHub stars sarif
EDITORCONFIG editorconfig-checkerEDITORCONFIG_EDITORCONFIG_CHECKER GitHub stars
GHERKIN gherkin-lintGHERKIN_GHERKIN_LINT GitHub stars
KUBERNETES kubeconformKUBERNETES_KUBECONFORM GitHub stars
KUBERNETES helmKUBERNETES_HELM GitHub stars
KUBERNETES kubescapeKUBERNETES_KUBESCAPE GitHub stars sarif
PUPPET puppet-lintPUPPET_PUPPET_LINT GitHub stars autofix
SNAKEMAKE snakemakeSNAKEMAKE_LINT disabled GitHub stars
SNAKEMAKE snakefmtSNAKEMAKE_SNAKEFMT GitHub stars formatter
TEKTON tekton-lintTEKTON_TEKTON_LINT GitHub stars
TERRAFORM tflintTERRAFORM_TFLINT GitHub stars sarif
TERRAFORM terrascanTERRAFORM_TERRASCAN downgraded version GitHub stars sarif
TERRAFORM terragruntTERRAFORM_TERRAGRUNT GitHub stars autofix
TERRAFORM terraform-fmtTERRAFORM_TERRAFORM_FMT GitHub stars formatter

Other

Code quality checker Linter Additional
COPYPASTE jscpdCOPYPASTE_JSCPD GitHub stars
REPOSITORY checkovREPOSITORY_CHECKOV GitHub stars sarif
REPOSITORY devskimREPOSITORY_DEVSKIM GitHub stars sarif
REPOSITORY dustilockREPOSITORY_DUSTILOCK GitHub stars sarif
REPOSITORY git_diffREPOSITORY_GIT_DIFF GitHub stars
REPOSITORY gitleaksREPOSITORY_GITLEAKS GitHub stars sarif
REPOSITORY grypeREPOSITORY_GRYPE downgraded version GitHub stars sarif
REPOSITORY kicsREPOSITORY_KICS GitHub stars sarif
REPOSITORY ls-lintREPOSITORY_LS_LINT GitHub stars
REPOSITORY secretlintREPOSITORY_SECRETLINT GitHub stars sarif
REPOSITORY semgrepREPOSITORY_SEMGREP GitHub stars sarif
REPOSITORY syftREPOSITORY_SYFT GitHub stars sarif
REPOSITORY trivyREPOSITORY_TRIVY GitHub stars sarif
REPOSITORY trivy-sbomREPOSITORY_TRIVY_SBOM GitHub stars sarif
REPOSITORY trufflehogREPOSITORY_TRUFFLEHOG GitHub stars
SPELL cspellSPELL_CSPELL GitHub stars
SPELL proselintSPELL_PROSELINT GitHub stars
SPELL valeSPELL_VALE GitHub stars
SPELL lycheeSPELL_LYCHEE GitHub stars

Installation

Assisted installation

Just run npx mega-linter-runner --install at the root of your repository and answer questions, it will generate ready to use configuration files for MegaLinter :)

Runner Install

Which version to use ?

The following instructions examples are using latest MegaLinter stable version (v8 , always corresponding to the latest release)

You can also use beta version (corresponding to the content of main branch)

GitHub Action

  1. Create a new file in your repository called .github/workflows/mega-linter.yml
  2. Copy the example workflow from below into that new file, no extra configuration required
  3. Commit that file to a new branch
  4. Open up a pull request and observe the action working
  5. Enjoy your more stable, and cleaner code base

NOTES:

In your repository you should have a .github/workflows folder with GitHub Action similar to below:

MegaLinter GitHub Action configuration file

More info at https://megalinter.io

name: MegaLinter

on:

Trigger mega-linter at every push. Action will also be visible from Pull Requests to main

push: # Comment this line to trigger action only on pull-requests (not recommended if you don't pay for GH Actions) pull_request: branches: [master, main]

env: # Comment env block if you don't want to apply fixes

Apply linter fixes configuration

APPLY_FIXES: all # When active, APPLY_FIXES must also be defined as environment variable (in github/workflows/mega-linter.yml or other CI tool) APPLY_FIXES_EVENT: pull_request # Decide which event triggers application of fixes in a commit or a PR (pull_request, push, all) APPLY_FIXES_MODE: commit # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) or posted in a PR (pull_request)

concurrency: group: github.ref−{{ github.ref }}-github.ref−{{ github.workflow }} cancel-in-progress: true

jobs: megalinter: name: MegaLinter runs-on: ubuntu-latest permissions: # Give the default GITHUB_TOKEN write permission to commit and push, comment issues & post new PR # Remove the ones you do not need contents: write issues: write pull-requests: write steps: # Git Checkout - name: Checkout Code uses: actions/checkout@v4 with: token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }} fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances

  # MegaLinter
  - name: MegaLinter
    id: ml
    # You can override MegaLinter flavor used to have faster performances
    # More info at https://megalinter.io/flavors/
    uses: oxsecurity/megalinter@v8
    env:
      # All available variables are described in documentation
      # https://megalinter.io/configuration/
      VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} # Validates all source when push on main, else just the git diff with main. Override with true if you always want to lint all sources
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      # ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY
      # DISABLE: COPYPASTE,SPELL # Uncomment to disable copy-paste and spell checks

  # Upload MegaLinter artifacts
  - name: Archive production artifacts
    if: success() || failure()
    uses: actions/upload-artifact@v4
    with:
      name: MegaLinter reports
      path: |
        megalinter-reports
        mega-linter.log

  # Create pull request if applicable (for now works only on PR from same repository, not from forks)
  - name: Create Pull Request with applied fixes
    id: cpr
    if: steps.ml.outputs.has_updated_sources == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'pull_request' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && !contains(github.event.head_commit.message, 'skip fix')
    uses: peter-evans/create-pull-request@v6
    with:
      token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
      commit-message: "[MegaLinter] Apply linters automatic fixes"
      title: "[MegaLinter] Apply linters automatic fixes"
      labels: bot
  - name: Create PR output
    if: steps.ml.outputs.has_updated_sources == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'pull_request' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && !contains(github.event.head_commit.message, 'skip fix')
    run: |
      echo "Pull Request Number - ${{ steps.cpr.outputs.pull-request-number }}"
      echo "Pull Request URL - ${{ steps.cpr.outputs.pull-request-url }}"

  # Push new commit if applicable (for now works only on PR from same repository, not from forks)
  - name: Prepare commit
    if: steps.ml.outputs.has_updated_sources == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'commit' && github.ref != 'refs/heads/main' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && !contains(github.event.head_commit.message, 'skip fix')
    run: sudo chown -Rc $UID .git/
  - name: Commit and push applied linter fixes
    if: steps.ml.outputs.has_updated_sources == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'commit' && github.ref != 'refs/heads/main' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && !contains(github.event.head_commit.message, 'skip fix')
    uses: stefanzweifel/git-auto-commit-action@v4
    with:
      branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}
      commit_message: "[MegaLinter] Apply linters fixes"
      commit_user_name: megalinter-bot
      commit_user_email: 129584137+megalinter-bot@users.noreply.github.com

GitLab CI

Create or update .gitlab-ci.yml file at the root of your repository

MegaLinter GitLab CI job configuration file

More info at https://megalinter.io/

mega-linter: stage: test

You can override MegaLinter flavor used to have faster performances

More info at https://megalinter.io/flavors/

image: oxsecurity/megalinter:v8 script: [ "true" ] # if script: ["true"] doesn't work, you may try -> script: [ "/bin/bash /entrypoint.sh" ] variables: # All available variables are described in documentation # https://megalinter.io/configuration/ DEFAULT_WORKSPACE: $CI_PROJECT_DIR # ADD YOUR CUSTOM ENV VARIABLES HERE TO OVERRIDE VALUES OF .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY artifacts: when: always paths: - megalinter-reports expire_in: 1 week

Create a Gitlab access token and define it in a variable GITLAB_ACCESS_TOKEN_MEGALINTER in the project CI/CD masked variables. Make sure your token (e.g. if a project token) as the appropriate role for commenting a merge request (at least developer).

config-gitlab-access-token

Screenshot

Azure Pipelines

Use the following Azure Pipelines YAML template

You can configure a build validation branch policy against a single repository or across all repositories. If you configure across all repositories then your pipeline is stored in a central repository.

Single Repository

Add the following to an azure-pipelines.yaml file within your code repository:

Run MegaLinter to detect linting and security issues

Central Repository

Add the following to an azure-pipelines.yaml file within a separate repository e.g. 'MegaLinter' repository:

Run MegaLinter to detect linting and security issues

trigger: none

pool: vmImage: ubuntu-latest

variables: repoName: $[ replace(split(variables['System.PullRequest.SourceRepositoryURI'], '/')[6], '%20', ' ') ]

steps:

Checkout triggering repo

Pull MegaLinter docker image

Run MegaLinter

Upload MegaLinter reports

Pull Request Comments

To benefit from Pull Request comments, please follow configuration instructions

Detailed Tutorial

You can also follow this detailed tutorial by DonKoning

Bitbucket Pipelines

  1. Create a bitbucket-pipelines.yml file on the root directory of your repository
  2. Copy and paste the following template or add the step to your existing pipeline.

image: atlassian/default-image:3 pipelines: default: - parallel: - step: name: Run MegaLinter image: oxsecurity/megalinter:v8 script: - export DEFAULT_WORKSPACE=$BITBUCKET_CLONE_DIR && bash /entrypoint.sh artifacts: - megalinter-reports/**

Jenkins

Add the following stage in your Jenkinsfile

You may activate File.io reporter or E-mail reporter to access detailed logs and fixed source

// Lint with MegaLinter: https://megalinter.io/ stage('MegaLinter') { agent { docker { image 'oxsecurity/megalinter:v8' args "-u root -e VALIDATE_ALL_CODEBASE=true -v ${WORKSPACE}:/tmp/lint --entrypoint=''" reuseNode true } } steps { sh '/entrypoint.sh' } post { always { archiveArtifacts allowEmptyArchive: true, artifacts: 'mega-linter.log,megalinter-reports/**/*', defaultExcludes: false, followSymlinks: false } } }

CloudBees themselves made a nice tutorial about how to use MegaLinter with Jenkins !

Concourse

Pipeline step

Use the following job.step in your pipeline template

Note: make sure you have job.plan.get step which gets repo containing your repository as shown in example

OR

Use it as reusable task

Create reusable concourse task which can be used with multiple pipelines

  1. Create task file task-linting.yaml

platform: linux image_resource: type: docker-image source: repository: oxsecurity/megalinter tag: v8

inputs:

uncomment this if you want reports as task output

output:

- name: reports

path: repo/megalinter-reports

run: path: bash args:

  1. Use that task-linting.yaml task in pipeline

Note:

  1. make sure task-linting.yaml is available in that repo input at root
  2. task output is not shown here

resources:

Drone CI

Warning: Drone CI support is experimental and is undergoing heavy modifications (see issue #2047).

  1. Create a .drone.yml file on the root directory of your repository
  2. Copy and paste the following template:

kind: pipeline type: docker name: MegaLinter

workspace: path: /tmp/lint

steps:

This uses the Drone CI docker runner, so it's needed to install and configure it beforehand on your Drone CI server.

(Optional) Adjusting trigger rules

The Drone CI workflow should trigger automatically for every scenario (push, pull request, sync…) however, you can optionally change this behavior by changing the trigger. For example:

kind: pipeline type: docker name: MegaLinter

workspace: path: /tmp/lint

steps:

trigger: event:

The workflow above should only trigger on push, not on any other situation. For more information about how to configure Drone CI trigger rules, click here.

Docker container

You can also run megalinter with its Docker container, just execute this command:

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock:rw -v $(pwd):/tmp/lint:rw oxsecurity/megalinter:v8

No extra arguments are needed, however, megalinter will lint all of the files inside the /tmp/lint folder, so it may be needed to configure your tool of choice to use the /tmp/lint folder as workspace. This can also be changed:

Example:

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock:rw -v $(pwd):/example/folder:rw oxsecurity/megalinter:v8

Run MegaLinter locally

Version Downloads/week Downloads/total

You can use mega-linter-runner to locally run MegaLinter with the same configuration defined in .mega-linter.yml file

See mega-linter-runner installation instructions

Example

npx mega-linter-runner --flavor salesforce -e "'ENABLE=DOCKERFILE,MARKDOWN,YAML'" -e 'SHOW_ELAPSED_TIME=true'

Note: You can also use such command line in your custom CI/CD pipelines

Configuration

.mega-linter.yml file

MegaLinter configuration variables are defined in a .mega-linter.yml file at the root of the repository or with environment variables. You can see an example config file in this repo: .mega-linter.yml

Configuration is assisted with autocompletion and validation in most commonly used IDEs, thanks to JSON schema stored on schemastore.org

You can also define variables as environment variables.

Assisted configuration

Common variables

ENV VAR Default Value Notes
ADDITIONAL_EXCLUDED_DIRECTORIES [] List of additional excluded directory basenames. they're excluded at any nested level.
APPLY_FIXES none Activates formatting and autofix (more info)
CLEAR_REPORT_FOLDER false Flag to clear files from report folder (usually megalinter-reports) before starting the linting process
CONFIG_PROPERTIES_TO_APPEND [] List of configuration properties to append their values (instead of replacing them) in case of using EXTENDS.
DEFAULT_BRANCH HEAD Deprecated: The name of the repository's default branch.
DEFAULT_WORKSPACE /tmp/lint The location containing files to lint if you are running locally.
DISABLE_ERRORS false Flag to have the linter complete with exit code 0 even if errors were detected.
DISABLE List of disabled descriptors keys (more info)
DISABLE_LINTERS List of disabled linters keys (more info)
DISABLE_ERRORS_LINTERS List of enabled but not blocking linters keys. All linters not in this list will be not blocking (more info)
ENABLE_ERRORS_LINTERS List of enabled and blocking linters keys (more info)
ENABLE List of enabled descriptors keys (more info)
ENABLE_LINTERS List of enabled linters keys (more info)
EXCLUDED_DIRECTORIES […many values…] List of excluded directory basenames. they're excluded at any nested level.
EXTENDS Base mega-linter.yml config file(s) to extend local configuration from. Can be a single URL or a list of .mega-linter.yml config files URLs. Later files take precedence.
FAIL_IF_MISSING_LINTER_IN_FLAVOR false If set to true, MegaLinter fails if a linter is missing in the selected flavor
FAIL_IF_UPDATED_SOURCES false If set to true, MegaLinter fails if a linter or formatter has autofixed sources, even if there are no errors
FILTER_REGEX_EXCLUDE none Regular expression defining which files will be excluded from linting (more info) .ex: .*src/test.*)
FILTER_REGEX_INCLUDE all Regular expression defining which files will be processed by linters (more info) .ex: .*src/.*)
FLAVOR_SUGGESTIONS true Provides suggestions about different MegaLinter flavors to use to improve runtime performances
FORMATTERS_DISABLE_ERRORS true Formatter errors will be reported as errors (and not warnings) if this variable is set to false
GIT_AUTHORIZATION_BEARER If set, calls git with Authorization: Bearer+value
GITHUB_WORKSPACE Base directory for REPORT_OUTPUT_FOLDER, for user-defined linter rules location, for location of linted files if DEFAULT_WORKSPACE isn't set
IGNORE_GENERATED_FILES false If set to true, MegaLinter will skip files containing @generated marker but without @not-generated marker (more info at https://generated.at)
IGNORE_GITIGNORED_FILES true If set to true, MegaLinter will skip files ignored by git using .gitignore file
JAVASCRIPT_DEFAULT_STYLE standard Javascript default style to check/apply. standard,prettier
LINTER_RULES_PATH .github/linters Directory for all linter configuration rules. Can be a local folder or a remote URL (ex: https://raw.githubusercontent.com/some\_org/some\_repo/mega-linter-rules )
LOG_FILE mega-linter.log The file name for outputting logs. All output is sent to the log file regardless of LOG_LEVEL. Use none to not generate this file.
LOG_LEVEL INFO How much output the script will generate to the console. One of INFO, DEBUG, WARNING or ERROR.
MARKDOWN_DEFAULT_STYLE markdownlint Markdown default style to check/apply. markdownlint,remark-lint
MEGALINTER_CONFIG .mega-linter.yml Name of MegaLinter configuration file. Can be defined remotely, in that case set this environment variable with the remote URL of .mega-linter.yml config file
MEGALINTER_FILES_TO_LINT [] Comma-separated list of files to analyze. Using this variable will bypass other file listing methods
PARALLEL true Process linters in parallel to improve overall MegaLinter performance. If true, linters of same language or formats are grouped in the same parallel process to avoid lock issues if fixing the same files
PARALLEL_PROCESS_NUMBER All available cores are used by default. If there are too many, you need to decrease the number of used cores in order to enhance performances (example: 4)
PLUGINS [] List of plugin urls to install and run during MegaLinter run
POST_COMMANDS [] Custom bash commands to run after linters
PRE_COMMANDS [] Custom bash commands to run before linters
PRINT_ALPACA true Enable printing alpaca image to console
PRINT_ALL_FILES false Display all files analyzed by the linter instead of only the number
PYTHON_DEFAULT_STYLE black Python default style to check/apply. black,ruff
REPORT_OUTPUT_FOLDER ${GITHUB_WORKSPACE}/megalinter-reports Directory for generating report files. Set to none to not generate reports
SECURED_ENV_VARIABLES [] Additional list of secured environment variables to hide when calling linters.
SECURED_ENV_VARIABLES_DEFAULT MegaLinter & CI platforms sensitive variables List of secured environment variables to hide when calling linters. Default list. This is not recommended to override this variable, use SECURED_ENV_VARIABLES
SHOW_ELAPSED_TIME false Displays elapsed time in reports
SHOW_SKIPPED_LINTERS true Displays all disabled linters mega-linter could have run
SKIP_CLI_LINT_MODES [] Comma-separated list of cli_lint_modes. To use if you want to skip linters with some CLI lint modes (ex: file,project). Available values: file,cli_lint_mode,project.
SKIP_LINTER_OUTPUT_SANITIZATION false By default, MegaLinter sanitizes the output of every external command using Gitleaks public rules.If you are on a private and secured repo, you can improve performances by setting this variable to true, but it will mean that if a linter output contains a secret, it will be visible in log files
TYPESCRIPT_DEFAULT_STYLE standard Typescript default style to check/apply. standard,prettier
VALIDATE_ALL_CODEBASE true Will parse the entire repository and find all files to validate across all types. NOTE: When set to false, only new or edited files will be parsed for validation.

Activation and deactivation

MegaLinter have all linters enabled by default, but allows to enable only some, or disable only some

Examples:

ENABLE: JAVASCRIPT,GROOVY DISABLE_LINTERS: JAVASCRIPT_STANDARD DISABLE_ERRORS_LINTERS: REPOSITORY_DEVSKIM

ENABLE_ERRORS_LINTERS: REPOSITORY_TRIVY

DISABLE_LINTERS:

Filter linted files

If you need to lint only a folder or exclude some files from linting, you can use optional environment parameters FILTER_REGEX_INCLUDE and FILTER_REGEX_EXCLUDEYou can apply filters to a single linter by defining variable <LINTER_KEY>_FILTER_REGEX_INCLUDE and <LINTER_KEY>_FILTER_REGEX_EXCLUDE

Examples:

Warning: not applicable with linters using CLI lint mode project (see details)

Apply fixes

Mega-linter is able to apply fixes provided by linters. To use this capability, you need 3 env variables defined at top level

Only for GitHub Action Workflow file if you use it:

Apply fixes issues

You may see github permission errors, or workflows not run on the new commit.

To solve these issues, you can apply one of the following solutions.

Notes

Linter specific variables

See variables related to a single linter behavior in linters documentations

Pre-commands

MegaLinter can run custom commands before running linters (for example, installing an plugin required by one of the linters you use)

Example in .mega-linter.yml config file

PRE_COMMANDS:

Property Description Default value
command Command line to run Mandatory
cwd Directory where to run the command (workspace or root) workspace
run_before_linters If set to true, runs the command before the execution of the linters themselves, required for npm/pip commands that cannot be run in parallel false
run_after_linters If set to true, runs the command after the execution of the linters themselves false
secured_env Apply filtering of secured env variables before calling the command (default true)Be careful if you disable it ! true
continue_if_failed If set to false, stop MegaLinter process in case of command failure true
venv If set, runs the command into the related python venv
output_variables ENV variables to get from output after running the commands, and store in MegaLinter ENV context, so they can be reused in next commands []
tag Tag defining at which commands entry point the command will be run (available tags: before_plugins)

Post-commands

MegaLinter can run custom commands after running linters (for example, running additional tests)

Example in .mega-linter.yml config file

POST_COMMANDS:

Environment variables security

Secured env variables

MegaLinter runs on a docker image and calls the linters via command line to gather their results.

If you run it from your CI/CD pipelines, the docker image may have access to your environment variables, that can contain secrets defined in CI/CD variables.

As it can be complicated to trust the authors of all the open-source linters, MegaLinter removes variables from the environment used to call linters.

Thanks to this feature, you only need to trust MegaLinter and its internal python dependencies, but there is no need to trust all the linters that are used !

You can add secured variables to the default list using configuration property SECURED_ENV_VARIABLES in .mega-linter.yml or in an environment variable (priority is given to ENV variables above .mega-linter.yml property).

Values can be:

Environment variables are secured for each command line called (linters, plugins, sarif formatter...) except for PRE_COMMANDS , ONLY if you define secured_env: false in the command.

Secured configuration examples

SECURED_ENV_VARIABLES:

SECURED_ENV_VARIABLES=MY_SECRET_TOKEN,ANOTHER_VAR_CONTAINING_SENSITIVE_DATA,OX_API_KEY

Default secured variables

If you override SECURED_ENV_VARIABLES_DEFAULT, it replaces the default list, so it's better to only define SECURED_ENV_VARIABLES to add them to the default list !

SECURED_ENV_VARIABLES_DEFAULT contains:

Unhide variables for linters

You can configure exceptions for a specific linter by defining (linter-key)_UNSECURED_ENV_VARIABLES.

Variable names in this list won't be hidden to the linter commands.

TERRAFORM_TFLINT_UNSECURED_ENV_VARIABLES:

CLI lint mode

Each linter is pre-configured to use a default lint mode, which are visible in the MegaLinter documentation (example). The possible values are:

You can override the CLI_LINT_MODE by using a configuration variable for each linter (see linters documentation).

Allowing file or list_of_files to be overridden to project is mostly for workarounds. For example, some linters have a problem finding their config file when the current folder isn't the repository's root folder.

Special considerations:

Reporters

MegaLinter can generate various reports that you can activate / deactivate and customize

Reporter Description Default
Text files Generates One log file by linter + suggestions for fixes that can not be automated Active
SARIF (beta) Generates an aggregated SARIF output file Inactive
GitHub Pull Request comments MegaLinter posts a comment on the PR with a summary of lint results, and links to detailed logs Active if GitHub Action
Gitlab Merge Request comments Mega-Linter posts a comment on the MR with a summary of lint results, and links to detailed logs Active if in Gitlab CI
Azure Pipelines Pull Request comments Mega-Linter posts a comment on the PR with a summary of lint results, and links to detailed logs Active if in Azure Pipelines
Bitbucket Pull Request comments Mega-Linter posts a comment on the PR with a summary of lint results, and links to detailed logs Active if in Bitbucket CI
API (Grafana) Sends logs and metrics to Grafana endpoint (Loki / Prometheus) Inactive
Updated sources Zip containing all formatted and autofixed sources so you can extract them in your repository Active
IDE Configuration Apply MegaLinter configuration in your local IDE with linter config files and IDE extensions Active
GitHub Status One GitHub status by linter on the PR, with links to detailed logs Active if GitHub Action
File.io Send reports on file.io so you can access them with a simple hyperlink provided at the end of console log Inactive
JSON Generates a JSON output report file Inactive
Email Receive all reports on your e-mail, if you can not use artifacts Active
TAP files One file by linter following Test Anything Protocol format Active
Console Execution logs visible in console with summary table and links to other reports at the end Active
Markdown Summary Generates a Markdown summary report file Inactive

Flavors

To improve run performances, we generate Flavored MegaLinter images containing only the list of linters related to a project type

The following table doesn't display docker pulls from MegaLinter v4 & v5 images.

Flavor Description Embedded linters Info
all Default MegaLinter Flavor 127 Docker Image Size (tag) Docker Pulls
c_cpp Optimized for pure C/C++ projects 56 Docker Image Size (tag) Docker Pulls
ci_light Optimized for CI items (Dockerfile, Jenkinsfile, JSON/YAML schemas,XML 22 Docker Image Size (tag) Docker Pulls
cupcake MegaLinter for the most commonly used languages 88 Docker Image Size (tag) Docker Pulls
documentation MegaLinter for documentation projects 49 Docker Image Size (tag) Docker Pulls
dotnet Optimized for C, C++, C# or VB based projects 64 Docker Image Size (tag) Docker Pulls
dotnetweb Optimized for C, C++, C# or VB based projects with JS/TS 73 Docker Image Size (tag) Docker Pulls
formatters Contains only formatters 18 Docker Image Size (tag) Docker Pulls
go Optimized for GO based projects 51 Docker Image Size (tag) Docker Pulls
java Optimized for JAVA based projects 53 Docker Image Size (tag) Docker Pulls
javascript Optimized for JAVASCRIPT or TYPESCRIPT based projects 59 Docker Image Size (tag) Docker Pulls
php Optimized for PHP based projects 54 Docker Image Size (tag) Docker Pulls
python Optimized for PYTHON based projects 65 Docker Image Size (tag) Docker Pulls
ruby Optimized for RUBY based projects 50 Docker Image Size (tag) Docker Pulls
rust Optimized for RUST based projects 50 Docker Image Size (tag) Docker Pulls
salesforce Optimized for Salesforce based projects 54 Docker Image Size (tag) Docker Pulls
security Optimized for security 24 Docker Image Size (tag) Docker Pulls
swift Optimized for SWIFT based projects 50 Docker Image Size (tag) Docker Pulls
terraform Optimized for TERRAFORM based projects 54 Docker Image Size (tag) Docker Pulls

If you need a new flavor, post an issue 😉

Badge

You can show MegaLinter status with a badge in your repository README

MegaLinter

If your main branch is master , replace main by master in URLs

Markdown

MegaLinter

MegaLinter

reStructuredText

.. |MegaLinter yes| image:: https://github.com///workflows/MegaLinter/badge.svg?branch=main 🎯 https://github.com///actions?query=workflow%3AMegaLinter+branch%3Amain

.. |MegaLinter yes| image:: https://github.com/nvuillam/npm-groovy-lint/workflows/MegaLinter/badge.svg?branch=main 🎯 https://github.com/nvuillam/npm-groovy-lint/actions?query=workflow%3AMegaLinter+branch%3Amain

Note: IF you did not use MegaLinter as GitHub Action name, please read GitHub Actions Badges documentation{target=_blank}

Plugins

For performances and security reasons, we can not embed all linters of the world within MegaLinter.

But our core architecture allows to build and publish MegaLinter Plugins !

External Plugins Catalog

Name Description Author Raw URL
jupyfmt The uncompromising Jupyter notebook formatter Kim Philipp Jablonski Descriptor
linkcheck Plugin to check and validate markdown links exist and working Shiran Rubin Descriptor
nitpick Command-line tool and flake8 plugin to enforce the same settings across multiple language-independent projects W. Augusto Andreoli Descriptor
mustache Plugin to validate Logstash pipeline definition files using mustache Yann Jouanique Descriptor
salt-lint Checks Salt State files (SLS) for best practices and behavior that could potentially be improved. Joachim Grimm Descriptor
docker-compose-linter Plugin to lint docker-compose files Wesley Dean Descriptor
repolinter Plugin to run TODO Group's repolinter to look for repository best practices Wesley Dean Descriptor
j2lint Plugin to lint Jinja2 files Wesley Dean Descriptor
fmlint Plugin to lint YAML frontmatter in Markdown documents Wesley Dean Descriptor

Note: Using an external plugin means you trust its author

Submit a Pull Request if you want your plugin to appear here :)

Use external plugins

Add plugin URLs in PLUGINS property of .mega-linter.yml. URLs must either begin with "https://" or take the form of "file://", where points to a valid plugin descriptor file.

Note: Both and the default mount directory (/tmp/lint/) will be checked for a valid descriptor.

Example

PLUGINS:

Create your own plugin

You can implement your own descriptors and load them as plugins during MegaLinter runtime

Limitations

They talk about MegaLinter

English articles

Article Author
Integrating MegaLinter to Automate Linting Across Multiple Codebases. A Technical Description{target=_blank} Thorsten Foltz{target=_blank}
MegaLinter Performance Tuning for Maximum Efficiency{target=_blank} Wes Dean{target=_blank}
10 MegaLinter Tips and Tricks Unlock its Full Potential{target=_blank} Wes Dean{target=_blank}
30 Seconds to Setup MegaLinter: Your Go-To Tool for Automated Code Quality{target=_blank} Peng Cao
Introducing MegaLinter: Streamlining Code Quality Checks Across Multiple Languages{target=_blank} Cloud Tuned{target=_blank}
Infrastructure as Code GitHub Codespace Template{target=_blank} Luke Murray{target=_blank}
5 ways MegaLinter upped our DevSecOps game{target=_blank} Wes Dean{target=_blank}
Achieve Code Consistency: MegaLinter Integration in Azure DevOps{target=_blank} Don Koning{target=_blank} on Microsoft Tech Community{target=_blank}
MegaLinter in Azure DevOps{target=_blank} James Cook{target=_blank}
Maximize your code consistency with Megalinter{target=_blank} Tor Ivar Asbølmo{target=_blank} on codewithme.cloud{target=_blank}
8 Tools to Scan Node.js Applications for Security Vulnerability{target=_blank} Chandan Kumar{target=_blank} on GeekFlare.com{target=_blank}
Use the Workflows JSON schema in your IDE{target=_blank} Google Cloud{target=_blank}
Level up your Unity Packages with CI/CD{target=_blank} RunningMattress{target=_blank}
Writing documentation as a champ in engineering teams{target=_blank} Gijs Reijn{target=_blank}
GitHub Actions: sharing your secrets with third-party actions{target=_blank} Constantin Bosse{target=_blank} and Stephen Hosom{target=_blank}
GitOps security topics you must address{target=_blank} Wiebe de Roos{target=_blank}
Talk about the Kotlin plugins Kover, Ktlint and Detekt. Made for the AmsterdamJUG meetup.{target=_blank} Simone de Gijt{target=_blank}
Linting - What is all the fluff about?{target=_blank} Neil Shepard{target=_blank}, University Of Sheffield
How to apply security at the source using GitOps{target=_blank} Edu Minguez{target=_blank}
How to linter basic things like trailing whitespaces and newlines{target=_blank} Nicolai Antiferov{target=_blank}
Open-source linters landscape in 2021{target=_blank} Cédric Teyton{target=_blank}
Node.js Coding Standard Tools with MegaLinter on Gitlab CI{target=_blank} Albion Bame{target=_blank}
Linting a Jekyll blog with MegaLinter{target=_blank} Alec Johnson{target=_blank}
MegaLinter sells his soul and joins OX Security{target=_blank} Nicolas Vuillamy{target=_blank}
Limit your technical debt and secure your code base using MegaLinter{target=_blank} Nicolas Vuillamy{target=_blank}

French articles

Article Author
MegaLinter{target=_blank} Stéphane Robert, 3DS OutScale{target=_blank}
MegaLinter: un linter pour les gouverner tous{target=_blank} Guillaume Arnaud, WeScale{target=_blank}
MegaLinter, votre meilleur ami pour un code de qualité{target=_blank} Thomas Sanson{target=_blank}

Japanese articles

Article Author
Try using MegaLinter{target=_blank} Takashi Minayaga{target=_blank}

Videos

Web Sites

Linters

Frequently Asked Questions

My repo CI already have linters and they're perfectly working, so why do I need MegaLinter ?

You can perfectly continue using your installed linters and deactivate them in .mega-linter.yml. For example, in a javascript project using eslint, you can configure MegaLinter with DISABLE: JAVASCRIPT. That way, you will benefit from both your installed linters but also from other MegaLinter linters checking JSON, YAML, Markdown, Dockerfile, Bash, spelling mistakes, dead URLs…

Ok but… how does it work ?

MegaLinter is based on Docker images containing either all linters, or just a selection of linters if you are using a MegaLinter flavor for a project using a specific language / format

The core architecture does the following:

How to contribute

Contributions to MegaLinter are very welcome, the more we're, the stronger MegaLinter is ! Please follow Contributing Guide

To help, you can also:

Special thanks

Maintainers

MegaLinter wouldn't be what it is without its great team of maintainers !

Contributors

Open-source teams

MegaLinter obviously would not exist without its linters and libraries, so many thanks to all the dedicated Open-Source teams maintaining all these awesome linters !

Super-Linter team

MegaLinter has been built on the ashes of a rejected Pull Request{target=_blank} on GitHub Super-Linter{target=_blank}.

Even if I disagree with their decision to remain in bash, the core team has always been nice and supporting during the time I was a Super-Linter contributor{target=_blank} :)

License

MegaLinter vs Super-Linter

The hard-fork of Super-Linter to be rewritten in Python isn't just a language switch: use of python flexibility and libraries allowed to define lots of additional functions described below

Security

MegaLinter hides many environment variables when calling the linters.

That way you need to trust only MegaLinter core code with your secrets, not the 100+ embedded linters !

Performances

More languages and formats linted

Automatically apply formatting and fixes

MegaLinter can automatically apply fixes performed by linters, and push them to the same branch, or create a Pull Request that you can validate

This is pretty handy, especially for linter errors related to formatting (in that case, you don't have any manual update to perform)

Run locally

MegaLinter can be run locally thanks to mega-linter-runner

Reports

Capabilities

Additional Reporters

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Enhanced Configuration

Runner Install

Assisted configuration

Enhanced Documentation

HTML doc home

HTML doc linter

HTML doc IDE

Plugins management

For linters less commonly used, MegaLinters offers a plugins architecture so anyone can publish plugins

Simplify architecture and evolutive maintenance

Improve robustness & stability